Is Curity agent-ready?

Curity scores Band B on The Headless Index. Its JAIRF rating is not available because no machine-readable spec was scored. Its strongest area for agent use is headless operation; its weakest is webhooks and events.

Does Curity publish an OpenAPI spec?

No published OpenAPI specification was found when Curity was scored. That caps its JAIRF dimensions and forces agents to rely on documentation or reverse engineering to operate it.

What is Curity's Headless Index score?

Curity scores 62/100 on the Headless Index thesis-fit rubric and sits in Band B in the Auth & Identity category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.

03 / Scorecard / Auth & Identity

Curity

Headless Index

62/100

JAIRF

N/A

Verified

AUG 20, 2026

Methodology v1 · JAIRF v1.0.0

Curity earns Band B in the Auth & Identity category of The Headless Index, with a thesis-fit score of 62/100. Its strongest dimension is headless operation (18/20); its weakest scored dimension is webhooks and events (8/20). No public OpenAPI specification was found when Curity was scored, which limits how far an agent can go without human integration work.

Editorial verdict

Curity is solidly built for programmatic consumption. The Headless Index thesis-fit score of 62/100 lands it in the upper-middle of the index, and JAIRF is recorded as N/A for this vendor because no public OpenAPI specification was reachable for the open-source scorer. In practice, vendors at this tier ship most of the primitives agents need, with one or two surfaces still leaning on documentation rather than discovery, and the rest of this verdict explains where Curity lands inside that pattern. On the API surface, the question is whether the API is the product or a layer beneath the dashboard. Curity is a self-hosted server, so there is no hosted API host to name. What it does expose is a configuration API in two flavours, RESTCONF and GraphQL, alongside standards endpoints for OAuth and OIDC. An agent can drive this product across most practical workflows, with a handful of edges where documentation reading still beats schema discovery. On headless operability: Configuration is the deployment artifact here, not a database the console mutates behind your back. The whole server state is a document you post over RESTCONF, ship in a container image, or install with the published Helm chart (github.com/curityio/idsvr-helm). Authentication actions are compiled Java plugins. Almost nothing in this product requires the admin UI to exist.^[1] On the MCP and agent-integration axis, which is the fastest-moving criterion in the index: Curity has engaged with agents from the security side only. The repo the crawler found (github.com/curityio/mcp-authorization-secured-api, updated August 2026) demonstrates protecting an MCP server with token exchange and scoped claims; it does not expose Curity to an agent. No server, no registry entry, no toolkit. Credible thinking, but no callable surface for an agent to use.^[2] Event posture closes the loop: an agent that cannot react to state changes is reduced to polling. Curity publishes no outbound event contract. The system admin guide has no webhook section, no event type list, no signing scheme and no retry policy. What exists instead is the plugin route (Java event listeners compiled into the server) plus log output for a SIEM to consume. That is integration work an operator does, not a stream an agent subscribes to. Net assessment: Curity can be operated by agents for the majority of practical workflows. The closest thing to a gap is webhooks and events^[3], which integrators should sanity-check against their own use case before committing. Strong fit for agent-driven use cases.

Verdict by Headless Index pipeline (auto)

// AI-drafted from the evidence layer. Editorial review pending.

Scores

Scorecard detail

Headless Index · 5 sub-criteria

API-first design intent14/20

scored

Curity is a self-hosted server, so there is no hosted API host to name. What it does expose is a configuration API in two flavours, RESTCONF and GraphQL, alongside standards endpoints for OAuth and OIDC. The gap is packaging: the curityio org publishes code examples (github.com/curityio/openid-client-ios-appauth) rather than client libraries you install.

signals (6)

+AI review appliedReviewer: Editorial review on 2026-08-19
−OpenAPI specNot found across 17 probe paths
−GraphQL endpointNot discovered (5 probes; project-scoped endpoints require a real project ID)
+SDKs maintained22 (dotnet, go, java, javascript, kotlin, python, swift, typescript); top by stars: curityio/spring-boot-oauth-client (13 stars)
+SDK recency1 of 22 SDK repos pushed within 30 days (most recent SDK commit: 2026-08-17)
+npm weekly downloads13.5M across published packages; top: npm @ 13.5M/week

cite (1)

github.sdks@2026-08-19

Headless operation18/20

scored

Configuration is the deployment artifact here, not a database the console mutates behind your back. The whole server state is a document you post over RESTCONF, ship in a container image, or install with the published Helm chart (github.com/curityio/idsvr-helm). Authentication actions are compiled Java plugins. Almost nothing in this product requires the admin UI to exist.

signals (9)

+AI review appliedReviewer: Editorial review on 2026-08-19
−API operations exposedNo OpenAPI spec; operations count unknown
·Docs pages crawled0 pages (crawler: none)
·Auth schemes documentedAuth documentation page not reached by crawler
·Setup / quickstart docsNot reached by crawler
·Billing docsNot reached by crawler
·Teams / org docsNot reached by crawler
·CLI docsNot reached by crawler
·Schema / data model docsNot reached by crawler

cite (1)

ai_review_browser.topics_found@2026-08-19

MCP & agent posture10/20

scored

Curity has engaged with agents from the security side only. The repo the crawler found (github.com/curityio/mcp-authorization-secured-api, updated August 2026) demonstrates protecting an MCP server with token exchange and scoped claims; it does not expose Curity to an agent. No server, no registry entry, no toolkit. Credible thinking, but no callable surface for an agent to use.

signals (4)

+AI review appliedReviewer: Editorial review on 2026-08-19
+Official MCP serverhttps://github.com/curityio/mcp-authorization-secured-api (6 stars, last commit 2 days ago)
−Community MCP serversNone found
+Agent-friendly SDKs5 TS/JS SDKs available; top: serverless-zero-trust-api

cite (1)

ai_review_browser.mcp@2026-08-19

Schema observability12/20

scored

Self-hosting means nothing is fetchable from the public internet, which the crawler correctly scored as absent. In a running deployment the picture improves: the admin GraphQL APIs support introspection, and the RESTCONF model derives from a YANG schema that the configuration reference documents field by field (curity.io/docs/idsvr/latest/system-admin-guide/api). No OpenAPI document exists in either form.

signals (3)

+AI review appliedReviewer: Editorial review on 2026-08-19
−OpenAPINot discovered across 17 standard probe paths
−GraphQL introspectionNo GraphQL endpoint discovered (5 probes; some vendors use project-scoped endpoints that require a real project handle)

cite (1)

ai_review_browser.pages_fetched@2026-08-19

Webhooks & events8/20

scored

Curity publishes no outbound event contract. The system admin guide has no webhook section, no event type list, no signing scheme and no retry policy. What exists instead is the plugin route (Java event listeners compiled into the server) plus log output for a SIEM to consume. That is integration work an operator does, not a stream an agent subscribes to.

signals (2)

+AI review appliedReviewer: Editorial review on 2026-08-19
·Webhook docs pageNot reached by crawler within budget (0 pages crawled). Cannot confirm whether vendor offers webhooks.

cite (1)

ai_review_browser.pages_fetched@2026-08-19

JAIRF · 6 dimensions

JAIRF · N/A

This vendor does not publish a public OpenAPI specification. JAIRF cannot be computed. The Headless Index score and editorial verdict carry the readiness assessment.

No public OpenAPI specification discovered during collection

Band rationale:B band: JAIRF=N/A HeadlessIndex=62

04 / Embed

Show Curity's score on your site.

Drop a live badge into your README, footer, or marketing page. It updates automatically when we re-score, and every embed is a dofollow link back here.

Get embed code

Peers in Auth & Identity

Better AuthB

Headless Index 63/100

UnkeyB

Headless Index 60/100

PropelAuthB

Headless Index 60/100

See full Auth & Identity ranking →

FAQ

Curity and agent readiness

Is Curity agent-ready?: Curity scores Band B on The Headless Index. Its JAIRF rating is not available because no machine-readable spec was scored. Its strongest area for agent use is headless operation; its weakest is webhooks and events.
Does Curity publish an OpenAPI spec?: No published OpenAPI specification was found when Curity was scored. That caps its JAIRF dimensions and forces agents to rely on documentation or reverse engineering to operate it.
What is Curity's Headless Index score?: Curity scores 62/100 on the Headless Index thesis-fit rubric and sits in Band B in the Auth & Identity category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.